bullhead-repo/CVE-2018-6606

GitHubRepository PoCExploit

PoC files

5 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A C program that extracts an embedded kernel driver, installs it as a service, and uses IOCTL codes to terminate an arbitrary process by PID, requiring administrator privileges.

Backdoor review

No backdoor observed in reviewed code

The PoC for CVE-2018-6606 is a local privilege escalation exploit that extracts an embedded kernel driver, installs it as a service, and uses IOCTL calls to terminate a target process. The code is straightforward and matches the disclosed vulnerability description. No concealed network activity, data exfiltration, or unrelated payload execution was found. The binary driver is uninspected, but its use is the core of the disclosed exploit.

ClassificationExploit
Model confidence95%
AuthenticationRequired
LanguagesC
Target softwareMalwareFox AntiMalwarezam32.syszam64.sys
Attack typesprivilege escalationdenial of service
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The code actively exploits CVE-2018-6606 by loading a vulnerable driver and sending IOCTL codes to terminate an arbitrary process, which constitutes privilege escalation/denial of service exploitation, not mere detection or scanning.

main.c:130-155README.md:3

Requirements

  • Administrator privileges are required to write the driver to System32 and create/start the kernel service.README.md:6
  • The target process ID (PID) must be provided as a command-line argument.main.c:22-25

Observed behavior

  • Extracts an embedded .sys driver from the executable's resource section and writes it to C:\Windows\System32\drivers\dot_sys.sys.main.c:42-86
  • Creates and starts a kernel driver service named 'dot_sys'.main.c:88-114
  • Opens a handle to \\.\ZemanaAntiMalware and sends IOCTL 0x80002010 to register the current process with the driver.main.c:116-142
  • Sends IOCTL 0x80002048 with the target PID to terminate the specified process.main.c:144-155
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

File Write
C:\Windows\System32\drivers\dot_sys.sysThe PoC writes an embedded driver to the system drivers directory, which is required for the privilege escalation exploit.main.c:62-70
Service Creation
dot_sys kernel driver serviceThe PoC creates and starts a kernel driver service to interact with the vulnerable driver.main.c:88-108
Ioctl Call
0x80002010 and 0x80002048The PoC uses IOCTL codes to register with the vulnerable driver and terminate a target process, matching the CVE description.main.c:130-154
Review boundaries

What the analysis did not establish

  • The embedded .sys driver (dot_sys.sys) is a binary file that was not inspected; its exact behavior is inferred from the C code and CVE description.
  • The resource.rc file and Makefile are not included in the text evidence, so the exact resource embedding and compilation steps are not fully visible.
  • The code was not executed; classification is based solely on static analysis of the provided source.
  • The embedded binary driver (dot_sys.sys) was not inspected and could contain additional behavior beyond the disclosed exploit, but no evidence suggests it does.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1